Log in Start free

Vulnerability · Published Jan 5, 2026 · Assigned by GitHub_M

CVE-2025-69223AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

High 7.5

In plain English

A high-severity resource allocation without limits in aiohttp from aio-libs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 52.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23py3-aiohttp3.13.3-r0ALPINE-CVE-2025-69223
Alpine:v3.24py3-aiohttp3.13.3-r0ALPINE-CVE-2025-69223
Debian:12python-aiohttp3.8.4-1+deb12u2DEBIAN-CVE-2025-69223
Debian:13python-aiohttp3.11.16-1+deb13u1DEBIAN-CVE-2025-69223
Debian:14python-aiohttp3.13.3-1DEBIAN-CVE-2025-69223
PyPIaiohttp3.13.3PYSEC-2026-1101
PyPIaiohttp3.13.3GHSA-6mq8-rvhq-8wgg
Ubuntu:25.10python-aiohttp3.11.16-1ubuntu0.1UBUNTU-CVE-2025-69223

Affected products (as reported)

VendorProductVersions
aio-libs aiohttp < 3.13.3

Weakness: CWE-409, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References